|
Answer» SysProt AntiRootkit v1.0.1.0
by swatkat
******************************************************************************************
******************************************************************************************
No Hidden Processes FOUND
******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_iaStor.sys
Service Name: ---
Module Base: A1FD4000
Module End: A20AA000
Hidden: Yes
Module Name: \??\C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\catchme.sys
Service Name: catchme
Module Base: F783F000
Module End: F7847000
Hidden: Yes
Module Name: \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
Service Name: ---
Module Base: F7A47000
Module End: F7A49000
Hidden: Yes
******************************************************************************************
******************************************************************************************
No SSDT Hooks found
******************************************************************************************
******************************************************************************************
Kernel Hooks:
Hooked Function: ZwYieldExecution
At Address: 80504B08
Jump To: F719A164
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwUnmapViewOfSection
At Address: 805B2E48
Jump To: F719A190
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwTerminateProcess
At Address: 805D29E2
Jump To: F719A1A4
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwSetValueKey
At Address: 80622662
Jump To: F719A13A
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwSetSecurityObject
At Address: 805C062E
Jump To: F719A150
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwRenameKey
At Address: 80623B12
Jump To: F719A10E
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwOpenThread
At Address: 805CB6CC
Jump To: F719A0BC
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwOpenProcess
At Address: 805CB440
Jump To: F719A0A8
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwOpenKey
At Address: 806254CE
Jump To: F719A0D0
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwMapViewOfSection
At Address: 805B203A
Jump To: F719A17A
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwDeleteValueKey
At Address: 8062475C
Jump To: F719A124
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwDeleteKey
At Address: 8062458C
Jump To: F719A0F8
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
Hooked Function: ZwCreateKey
At Address: 806240F0
Jump To: F719A0E4
Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys
******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\ffa4a94764f65568af221bcd6ed00d57\update\update.exe
Status: Access denied
Object: C:\ffa4a94764f65568af221bcd6ed00d57\update\updspapi.dll
Status: Access denied
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\COOKIES.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied
Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied
Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied
I'd like to scan your machine with ESET OnlineScan
•Hold down Control and click on the following link to open ESET OnlineScan in a new WINDOW.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
•Check
•Click the button.
•Accept any security warnings from your BROWSER.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
[emailprotected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=7decb2cbc2b65e4197eb2141c3f1522b
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-04-19 12:53:52
# local_time=2011-04-18 08:53:52 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 843393 843393 0 0
# compatibility_mode=5121 16777173 100 75 1092715 30792013 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=109203
# found=2
# cleaned=2
# scan_time=35359
C:\Documents and Settings\Michael Coyne\My Documents\My Music\04 Track 4.wmaWin32/Adware.180Solutions application (cleaned by deleting - quarantined)00000000000000000000000000000000C
C:\Documents and Settings\Michael Coyne\My Documents\My Music\Adobe Photoshop CS Activator.exeprobably a variant of Win32/TrojanDownloader.Agent.IPGQQOF trojan (cleaned by deleting - quarantined)00000000000000000000000000000000C
That looks good. If there are no other issues, we can do some cleanup.
To uninstall ComboFix
- Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
- In the field, type in ComboFix /uninstall
(Note: Make sure there's a space between the word ComboFix and the forward-slash.)
- Then, press Enter, or click OK.
- This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
*************************************************
Clean out your temporary internet files and temp files.
Download TFC by OldTimer to your desktop.
Double-click TFC.exe to run it.
Note: If you are running on Vista, right-click on the file and choose Run As Administrator
TFC will close all programs when run, so make sure you have saved all your work before you begin.
* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.
Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
************************************************
Use the Secunia Software Inspector to check for out of date software.
•Click Start Now
•Check the box next to Enable thorough system inspection.
•Click Start
•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------
Go to Microsoft Windows Update and get all critical updates.
----------
I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.
SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here
Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ
Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.
Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!
|
